Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a Juniper SSG5 firewall I'm using for VPN at a remote site, and I'm using Shrew Soft VPN client to connect from my office to this site.

If I connect to the web GUI or SSH of the Juniper from the LAN at the remote site, there are no problems. However, if I try to connect to the Juniper web GUI or SSH through the VPN, it does not respond.

Further details:

  • Pinging the Juniper through the VPN works fine.
  • The VPN itself seems to be working ok - I can connect to other devices on the remote LAN (for example, I can connect to one of the other devices and SSH back to the Juniper).
  • Doing a debug all on the Juniper device shows nothing (neither does debug ike), however, I know the machine in my office is routing the connection attempts through the VPN as I can see the attempts in the log of the policy that allows VPN connections into the network.
  • The log mentioned above shows "Close - AGE OUT" for all my connection attempts (apart from ping, which is working ok).
  • The interfaces involved all have the web GUI and SSH enabled on them.
  • I don't have any IP access policies set up on the device.

I thought perhaps the problem was related to MTU, so lowered the MTU on the Juniper interface and removed SSL from the web GUI, but it doesn't help (pinging at 1500 MTU works though, so I assume that means MTU isn't an issue?).

I'm not really sure why else it wouldn't respond. I can't find anything about VPN connections being disallowed admin access, I can't see any settings to enable/disable VPN admin access.

The only other thing I think might be relevant is that I have the following setting configured for my VPN:

unset ike policy-checking

Anyone have any ideas?

Thanks in advance!

share|improve this question

1 Answer 1

up vote 0 down vote accepted

For some reason, switching from policy-based to route-based VPN fixed the issue.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.